setup-exercode-course-repository

Warn

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes mise trust --yes to automatically approve configuration files provided by the repository. This bypasses the interactive confirmation step usually required by the mise tool before applying environment changes or shell aliases defined in local configuration files.\n- [DYNAMIC_EXECUTION]: The workflow relies on mise install to set up runtimes and tools based on repository-controlled files (mise.toml, .tool-versions). This enables the dynamic configuration of the execution environment, which could be exploited if the configuration files contain malicious environment variables or paths.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the @exercode/problem-utils package from the public NPM registry and downloads specific versions of Bun and Node.js as defined in the repository's configuration.\n- [INDIRECT_PROMPT_INJECTION]: The skill's behavior is influenced by the content of tracked root tooling files which are ingested into the agent's context. \n
  • Ingestion points: Inspects mise.toml, .mise.toml, .tool-versions, and package.json from the repository root.\n
  • Boundary markers: Absent. The skill does not implement delimiters or warnings to ignore potentially malicious instructions inside these configuration files.\n
  • Capability inventory: Includes file modification (package.json, .gitignore), network downloads (bun add), and environment management (mise trust, mise install).\n
  • Sanitization: None. The agent uses the configuration values directly to perform setup tasks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 6, 2026, 09:03 AM
Security Audit — agent-trust-hub — setup-exercode-course-repository